The website in the handover folder
The business changed hands, or you joined as the person now responsible for marketing, and the website is yours. Along with it came a login or two, maybe, and a vague sense that "the web guy" handles it. Nobody knows what it is built on, who pays for what, or whether it is doing anything.
Before spending a penny on improving it, spend two hours finding out what it is. This is the checklist we use when a site arrives with a new owner.
Part 1: what you own (30 minutes)
Work through the accounts and for each one, find out: does it exist, whose name is it in, can you log in, and what card pays for it.
- Domain registrar. Look the domain up in a WHOIS tool for the registrar name; find the account. If it is in the previous owner's or a developer's name, transferring it is your first priority.
- DNS, if separate (Cloudflare, the host).
- Hosting. Find the host from the site's IP; find the account.
- Website admin. The highest-level login.
- Email, if on the domain: Google Workspace, Microsoft 365, or the host.
- Google Business Profile, Search Console, Analytics. Who is the owner; add yourself.
- Booking tool, payment processor, form service, newsletter tool, social accounts.
- Any premium plugin or theme licences.
Write it in a table. Anything you cannot access or cannot identify goes on a list to chase, today, while the previous owner is still reachable.
Part 2: what it is built on (20 minutes)
- Platform. WordPress, Squarespace, Wix, Shopify, a bespoke build? A browser extension like Wappalyzer tells you in a click; so does viewing the page source.
- Theme and builder, for WordPress: name and version, and whether it uses Elementor, Divi or the block editor. Appearance, Themes in the admin.
- Plugins. The full list, with versions and last-updated dates. Count them. Note anything not updated in two years.
- WordPress and PHP version. Dashboard, Site Health.
- Hosting tier. Shared, managed, something else. Whether it has staging and backups.
This tells you whether the site is a sound foundation or a liability, and whether the eventual answer is maintain, fix or replace.
Part 3: is it about to break (15 minutes)
- Renewal dates. Domain, hosting, SSL, plugin licences. Anything within 90 days goes on the calendar now.
- Card on file. If the previous owner's card is paying for the hosting and they close it, the site goes off. Change every payment method to yours.
- Backups. Do any exist? Where? When was the last? Take a full one today, regardless.
- Security. Any signs of compromise: unknown admin users, odd pages, spam in the footer, Google showing a warning. Run a scan.
- Site Health warnings in the WordPress dashboard.
Part 4: is it working (30 minutes)
- Open it on your phone, on mobile data, in a private window. Does it load in under three seconds? Does it look right? Can you find the phone number and the way to book in one tap?
- Fill in the contact form. Does the email arrive? Where? If it goes to the previous owner's address, that is a leak of enquiries.
- Click Book. Complete a test booking. Does it work, does the confirmation arrive, does it hit the diary?
- Check the content. Prices current? Staff current? Hours current? Anything mentioning the previous owner by name?
- Search Console. Pages indexed, any errors, the Core Web Vitals grades, and the Performance report for the last three months. Is the site getting search traffic, and for what?
- Analytics. Visits and, if configured, enquiries by source. If conversions were never set up, you have no idea what the site produces; that is a fix.
- Google Business Profile. Claimed? Correct? Linked to the site? Reviews being answered?
Part 5: the decision (15 minutes)
You now know what you own, what it is built on, what will break and whether it works. Sort the findings:
Today: ownership transfers, payment methods, anything expiring within 90 days, a fresh backup, the contact form going to the right inbox.
This month: security issues, out-of-date platform, broken booking, wrong content, conversion tracking.
This quarter: the strategic call. Is this site worth maintaining as is, worth a fix-up project, or due a rebuild? The platform and plugin findings answer most of that, and the search data tells you what you would be protecting in a rebuild.
What usually turns up
Across the sites we have audited for new owners, the pattern is consistent: the domain is in someone else's name about a third of the time; the contact form goes to a dead or former address more often than you would think; there is no backup anyone can find; and the site has not been updated since it was built. None of these is a crisis if found now. Each is a crisis if found by the customer who could not get through.
Where this sits
This checklist is the first half of the diagnosis we run on any inherited site, and Part 1 is the half that matters most: nothing else can be fixed on a site you do not own. If the two hours produce a list you would rather hand to someone, that is what the diagnosis is for, and moving the site onto a care plan afterwards is how it stops arriving in this state for the next owner.